FACTOID # 10: The total number of state executions in 2005 was 60: 19 in Texas and 41 elsewhere. The racial split was 19 Black and 41 White.
 Home   Encyclopedia   Statistics   States A-Z   Flags   Maps   FAQ   About 


FACTS & STATISTICS    Advanced view

Search encyclopedia, statistics and forums:



(* = Graphable)



Encyclopedia > Keystroke logging

Keystroke logging (often called keylogging) is a diagnostic tool used in software development that captures the user's keystrokes. It can be useful to determine sources of error in computer systems and is sometimes used to measure employee productivity on certain clerical tasks. Such systems are also highly useful for law enforcement and espionage—for instance, providing a means to obtain passwords or encryption keys and thus bypassing other security measures. However, keyloggers are widely available on the Internet and can be used by private parties to spy on the computer usage of others. It has been suggested that this article or section be merged with Computer program. ... Wikipedia does not yet have an article with this exact name. ... This article or section is in need of attention from an expert on the subject. ... Spy and Secret agent redirect here. ...



Keystroke logging can be achieved by both hardware and software means. Hardware key loggers are commercially available devices which come in three types: inline devices that are attached to the keyboard cable, devices which can be installed inside standard keyboards, and actual replacement keyboards that contain the key logger already built-in. The inline devices have the advantage of being able to be installed instantly. However, while they may go unnoticed for quite some time, they are easily detected visually upon closer inspection. Of the three devices available, the most difficult to install is also the most difficult to detect. The device that installs inside a keyboard (presumably the keyboard the target has been using all along) requires soldering skill and extended access to the keyboard to be modified. However, once in place, this type of device is virtually undetectable unless specifically looked for. Hardware Keyloggers can be used for Keystroke logging. ... It has been suggested that this article or section be merged with Computer program. ... It has been suggested that Keystroke be merged into this article or section. ... A solder is a fusible metal alloy, with a melting point or melting range of 180-190°C (360-370 °F), which is melted to join metallic surfaces, especially in the fields of electronics and plumbing, in a process called soldering. ...


Writing software applications for keylogging is trivial, and like any computer program can be distributed as a trojan horse or as part of a virus. What is not trivial however, is installing a keystroke logger without getting caught and downloading data that has been logged without being traced. An attacker that manually connects to a host machine to download logged keystrokes risks being traced. A trojan that sends keylogged data to a fixed e-mail address or IP address risks exposing the attacker. The tone or style of this article or section may not be appropriate for Wikipedia. ... A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user. ... This article or section does not cite any references or sources. ...


Young and Yung devised several methods for solving this problem and presented them in their 1997 IEEE Security & Privacy paper[1] (their paper from '96 touches on it as well). They presented a deniable password snatching attack in which the keystroke logging trojan is installed using a virus (or worm). An attacker that is caught with the virus or worm can claim to be a victim. The cryptotrojan asymmetrically encrypts the pilfered login/password pairs using the public key of the trojan author and covertly broadcasts the resulting ciphertext. They mentioned that the ciphertext can be steganographically encoded and posted to a public bulletin board (e.g. Usenet). PKC, see PKC (disambiguation) Public-key cryptography is a form of modern cryptography which allows users to communicate securely without previously agreeing on a shared secret key. ... Steganography is the art and science of writing hidden messages in such a way that no one apart from the intended recipient knows of the existence of the message; this is in contrast to cryptography, where the existence of the message itself is not disguised, but the content is obscured. ... Usenet (USEr NETwork) is a global, decentralized, distributed Internet discussion system that evolved from a general purpose UUCP architecture of the same name. ...


Young and Yung also mentioned having the cryptotrojan unconditionally write the asymmetric ciphertexts to the last few unused sectors of every writable disk that is inserted into the machine. The sectors remain marked as unused. This can be done using a USB token. So, the trojan author may be one of dozens or even thousands of people that are given the stolen information. Only the trojan author can decrypt the ciphertext because only the author knows the needed private decryption key. This attack is from the field known as cryptovirology. This article is about algorithms for encryption and decryption. ... A USB Series “A” plug, the most common USB plug Universal Serial Bus (USB) is a serial bus standard to interface devices. ... Cryptovirology is a field that studies how to use cryptography to design powerful malicious software. ...

Federal Bureau of Investigation

The FBI used a keystroke logger to obtain the PGP passphrase of Nicodemo Scarfo, Jr., son of mob boss Nicodemo Scarfo. Scarfo Jr. pleaded guilty to running an illegal gambling operation in 2002.[2] The FBI has also reportedly developed a trojan-horse-delivered keylogger program known as Magic Lantern.[3] F.B.I. and FBI redirect here. ... Pretty Good Privacy is a computer program that provides cryptographic privacy and authentication. ... A passphrase is a sequence of words or other text used to control access to a computer system, program or data. ... Nicodemo Scarfo, Jr. ... Nicodemo Domenico Scarfo (born March 8, 1929) was an American mafioso, member of the U.S. Cosa Nostra, and head of the Scarfo Crime Family which controlled organized crime as far as southern New Jersey. ... Magic Lantern is a keystroke logging program developed by the Federal Bureau of Investigation. ...

Use in surveillance software

Some surveillance software has keystroke logging abilities and is advertised to monitor the internet use of minors. Such software has been criticized on privacy grounds, and because it can be used maliciously or to gain unauthorized access to users' computer systems.

Software logger types

Contrary to common understanding, software keyloggers are simple to write. With a working knowledge of C or C++ and a knowledge of the APIs provided by the target's operating system it is straight forward to do this. Software keyloggers fall into the following categories:

1) Kernel based: This method is most difficult both to write, and combat. Such keyloggers reside at the kernel level and are thus practically invisible. They almost always subvert the OS kernel and gain unauthorized access to the hardware which makes them very powerful. A keylogger using this method can act as a keyboard driver for example, and thus gain access to any information typed on the keyboard as it goes to the Operating System.

2) Hook based: Such keyloggers hook the keyboard with functions provided by the OS. The OS warns them any time a key is pressed and it records it.

3) Creative Methods: Here the coder uses functions like GetAsyncKeyState, GetForegroundWindow, etc. These are the easiest to write, but as they require polling the state of each key several times per second, they can cause a noticeable increase in CPU usage and can miss the occasional key.

Keylogger prevention

Currently there is no easy way to prevent keylogging. In the future it is believed that software with secure I/O will be protected from keyloggers. Until then, however, the best strategy is to use common sense and a combination of several methods. It is possible to use software to monitor the connectivity of the keyboard and log the absence as a countermeasure against physical keyloggers. For a PS/2 keyboard the timout bit (BIT6 at port 100) has to be monitored [1]. But this only makes sense when the PC is (nearly) always on.

Monitoring what programs are running

A user should constantly observe the programs which are installed on his or her machine. Also, devices connected to PS/2 and USB ports (which have both been hacked) can be used to secretly install a keylogger and then remove it (along with the user's data) by the perpetrator. e.g. ID Theft and installation of code thereby making fake pages that the IE goes to. A computer program is a collection of instructions that describe a task, or set of tasks, to be carried out by a computer. ...


Anti-spyware applications are able to detect many keyloggers and cleanse them. Responsible vendors of monitoring software support detection by anti-spyware programs, thus preventing abuse of the software. Anti spyware is a tool to detect and remove spyware. ... Anti spyware is a tool to detect and remove spyware. ...


Enabling a firewall does not stop keyloggers per se, but can possibly prevent transmission of the logged material over the net if properly configured. Firewall separating zones of trust A firewall is a hardware or software device which is configured to permit, deny, or proxy data through a computer network which has different levels of trust. ...

Network monitors

Network monitors (also known as reverse-firewalls) can be used to alert the user whenever an application attempts to make a network connection. This gives the user the chance to prevent the keylogger from "phoning home" with his or her typed information.

Automatic form filler programs

Automatic form-filling programs can prevent keylogging entirely by not using the keyboard at all. Form fillers are primarily designed for web browsers to fill in checkout pages and log users into their accounts. Once the user's account and credit card information has been entered into the program, it will be automatically entered into forms without ever using the keyboard or clipboard, thereby reducing the possibility that private data is being recorded. (Someone with access to browser internals and/or memory can often still get to this information; if SSL is not used, network sniffers and proxy tools can easily be used to obtain private information too.) A form filler is a software program that automatically fills forms in a UI. Form fillers can be part of a larger program, like a password manager or a enterprise single sign-on (E-SSO) solution. ... The clipboard is a software program that is used for short-term storage of data as it is transferred between documents or applications, via copy and paste operations. ...

It is important to generate passwords in a fashion that is invisible to keyloggers and screenshot utilities. Using a browser integrated form filler and password generator that does not just pop up a password on the screen is therefore key. Programs that do this can generate and fill passwords without ever using the keyboard or clipboard.

Alternative keyboard layouts

Most keylogging hardware/software assumes that a person is using the standard QWERTY keyboard layout, so by using a layout such as DVORAK, captured keystrokes are nonsense unless converted. For additional security, custom keyboard layouts can be created using tools like the Microsoft Keyboard Layout Creator. For the song by Linkin Park, see QWERTY (song). ... A standard Hebrew keyboard showing both Hebrew and English (QWERTY) letters. ...

One-time passwords (OTP)

Using one-time passwords is completely keylogger-safe because the recorded password is always invalidated right after it's used. This solution is useful if you are often using public computers where you can't verify what is running on them. The purpose of a one-time password (OTP) is to make it more difficult to gain unauthorized access to restricted resources, like a computer account. ...

Smart cards

Because of the integrated circuit of smart cards, they are not affected by keylogger and other logging attempts. A smart card can process the information and return back a unique challenge everytime you login. The information cannot usually be used to login again. Smart card used for health insurance in France. ...

On-screen keyboards

Program-to-program (non-web) keyboards

It is sometimes said that a third-party (or first party) on-screen keyboard program is a good way to combat keyloggers, as it only requires clicks of the mouse. However, this is not true, because for most on screen keyboards (such as the onscreen keyboard that comes with Microsoft Windows XP), a keyboard event message must be sent to the external target program to type text. Every software keylogger can log the text sent as typed characters from one program to another with an on-screen keyboard, and additionally, some programs also record or take snapshots of what is displayed on the screen. (Screenshot recorders are a concern whenever entire passwords are displayed; fast recorders are generally required to capture a sequence of virtual key presses.)

Web-based keyboards

Web-based on-screen keyboards (written in Javascript, etc.) may provide some degree of protection. At least some commercial keylogging programs do not record typing on a web-based virtual keyboard. (Screenshot recorders are a concern whenever entire passwords are displayed; fast recorders are generally required to capture a sequence of virtual key presses.)

Notably, the game MapleStory uses, in addition to a standard alphanumeric password, a 4-digit PIN code secured by both on-screen keyboard entry and a randomly changing button pattern; there is no real way to get the latter information without logging the screen and mouse movements; another MMORPG called RuneScape makes a similar system available for players to protect their in-game bank accounts with. This article is about the original game for Windows. ... PINs are most often used for ATMs but are increasingly used at the Point of sale, especially for debit cards. ... An image from World of Warcraft, one of the largest commercial MMORPGs as of 2004, based on active subscriptions. ... RuneScape is a Java-based MMORPG operated by Jagex Ltd. ...

Anti-keylogging software

Keylogger detection software is also available. Some of this type of software use "signatures" from a list of all known keyloggers. The PC's legitimate users can then periodically run a scan from this list, and the software looks for the items from the list on the hard-drive. One drawback of this approach is that it only protects from keyloggers on the signature-based list, with the PC remaining vulnerable to other keyloggers.

Other detection software doesn't use a signature list, but instead analyzes the working methods of many modules in the PC, allowing it to block the work of many different types of keylogger. One drawback of this approach is that it can also block legitimate, non-keylogging software. Some heuristics-based anti-keyloggers have the option to unblock known good software, but this can cause difficulties for inexperienced users.

Speech recognition

Similar to on-screen keyboards, speech-to-text conversion software can also be used against keyloggers, since there are no typing or mouse movements involved. The weakest point of this technique is, however, how the software sends the recognized text to target software after the recognition took place. Speech recognition (in many contexts also known as automatic speech recognition, computer speech recognition or erroneously as Voice Recognition) is the process of converting a speech signal to a sequence of words, by means of an algorithm implemented as a computer program. ...

Handwriting recognition / Mouse gestures

Also, many PDAs and lately Tablet PCs can already convert pen (also called stylus) movements on their touchscreens to computer understandable text successfully. Mouse gestures utilize this principle by using mouse movements instead of a stylus. Mouse gesture programs convert these strokes to user-definable actions, among others typing text. Similarly, Graphics tablets and light pens can be used to input these gestures, however, these are getting used less commonly everyday. Look up PDA in Wiktionary, the free dictionary. ... A Tablet PC is a notebook- or slate-shaped mobile computer. ... Touchscreens, touch screens, touch panels or touchscreen panels are display overlays which have the ability to display and receive information on the same screen. ... In computing, a mouse gesture is a way of combining computer mouse movements and clicks which the software recognizes as a specific command. ... A Wacom Graphire4 graphics tablet. ... A light pen is a computer input device in the form of a light-sensitive wand used in conjunction with the computers CRT monitor. ...

The same potential weakness of speech recognition applies this technique as well.

Macro expanders/recorders

With the help of many Freeware/Shareware programs, a seemingly unmeaningful text can be expanded to a meaningful text and most of the time context-sensitively, e.g. we can be expanded en.wikipedia.org when a browser window has the focus. The biggest weakness of this technique is that these programs send their keystrokes directly to the target program. However, this can be overcome by using the 'alternating' technique described below, i.e. sending mouse clicks to non-responsive areas of the target program, sending meaningless keys, sending another mouse click to target area (e.g. password field) and switching back and forth. The term Freeware refers to gratis proprietary software with closed source. ... Look up shareware in Wiktionary, the free dictionary. ...

Drag & Drop

Most keyloggers cannot intercept texts which are drag & dropped from one window to another. With the help of this technique, sensitive data could be transferred e.g. from a password manager to the target application. In computer graphical user interfaces, drag-and-drop is the action of (or support for the action of) clicking on a virtual object and dragging it to a different location or onto another virtual object. ... A password manager is software that helps a user organize passwords and PIN codes. ...

Window transparency

Using many readily available utilities, the target window could be made temporarily transparent, in order to hinder screen-capturing by advanced keyloggers. Although not a fool-proof technique against keyloggers on its own, this could be used in combination with other techniques.

Non technological methods

Most keyloggers can be fooled by alternating between typing the login credentials and typing characters somewhere else in the focus window. Similarly, one can move their cursor using the mouse during typing, causing the logged keystrokes to be in the wrong order. One can also use context menus to remove, copy, cut and paste parts of the typed text without using the keyboard. An example of a context menu taken from the word processor Microsoft Word. ...

Another very similar technique utilizes the fact that any selected text portion is replaced by the next key typed. E.g. if the password is "secret", one could type "s", then some dummy keys "asdfsd". Then these dummies could be selected with mouse, and next character from the password "e" is typed, which replaces the dummies "asdfsd".


  1. ^ A. Young, M. Yung, "Deniable Password Snatching: On the Possibility of Evasive Electronic Espionage," IEEE Symposium on Security & Privacy, pages 224-235, May 4-7, 1997.
  2. ^ "Mobster's son pleads guilty of gambling; computer spying helped seal case" Associated Press, 1 Mar 2002
  3. ^ http://www.msnbc.com/news/660096.asp?cp1=1

See also

It has been suggested that this article or section be merged into Black Bag Operation. ... Hardware Keyloggers can be used for Keystroke logging. ... Computer surveillance is the act of surveilling peoples computer activity without their knowledge, by accessing the computer itself. ... A large number of toolbars, some added by spyware, overwhelm an Internet Explorer session. ... The tone or style of this article or section may not be appropriate for Wikipedia. ...

External links

The Open Directory Project (ODP), also known as dmoz (from , its original domain name), is a multilingual open content directory of World Wide Web links owned by Netscape that is constructed and maintained by a community of volunteer editors. ...

Software (Anti-keylogging)

  • PSM Antikeylogger - Free software (GPL) antikeylogger that block hook-based keyloggers. For Windows 98, ME, 2000, XP.
  • Snoopfree Privacy Shield - Freeware antikeylogger that block hook-based keyloggers as well as screen captures. For Windows XP.
  • MyPlanetSoft Anti-Keylogger - Freeware antikeylogger that block hook-based keyloggers. For Windows 2000, XP.
  • Mouse-Only Keyboard - Free virtual keyboard with protection against hook-based keyloggers and clipboard protection.
  • KL-Detector v1.3- Freeware on demand keylogger scanner.
  • wssecure Application Monitor Realtime process monitoring with signature verification.

  Results from FactBites:
Keystroke logging - Wikipedia, the free encyclopedia (863 words)
Keystroke logging (often called keylogging) is a diagnostic used in software development that captures the user's keystrokes.
Keystroke logging can be achieved by both hardware and software means.
The FBI used a keystroke logger to obtain the PGP passphrase of Nicodemo Scarfo, Jr.
  More results at FactBites »



Share your thoughts, questions and commentary here
Your name
Your comments

Want to know more?
Search encyclopedia, statistics and forums:


Press Releases |  Feeds | Contact
The Wikipedia article included on this page is licensed under the GFDL.
Images may be subject to relevant owners' copyright.
All other elements are (c) copyright NationMaster.com 2003-5. All Rights Reserved.
Usage implies agreement with terms, 1022, m